CVE-2026-107716: Banks: Symlink traversal and arbitrary file disclosure/overwrite in DirectoryPromptRegistry

October 8, 2026

In banks.registries.DirectoryPromptRegistry, prompt file paths and the index file (index.json) do not refuse symbolic links. When a prompt directory contains or accepts untrusted files (e.g. unpacked archives, shared repositories, or multi-tenant folders), symbolic links pointing outside the registry root can be used to disclose arbitrary files via _scan() / get() or overwrite arbitrary files via set() / _save().

References

github.com/advisories/GHSA-556j-vv39-8rqv
github.com/masci/banks/commit/23ed13e50b4e217693fa5f9c30943fac8a41582f
github.com/masci/banks/pull/79
github.com/masci/banks/releases/tag/v2.5.1
github.com/masci/banks/security/advisories/GHSA-556j-vv39-8rqv
nvd.nist.gov/vuln/detail/CVE-2026-107716

Code Behaviors & Features

Detect and mitigate CVE-2026-107716 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →